Sovereignty · Updated 10 November 2026 · 9 min read

How public sector bodies in Europe choose a cloud provider in 2026

Procurement thresholds, national security schemes such as SecNumCloud, C5 and ENS, data protection and exit terms, and which providers state the matching certifications.

View as Markdown

A public body in Europe picks a cloud through a procurement procedure, not a sign-up form. The contract value decides whether EU tender rules apply, the sensitivity of the data decides which national security scheme the provider must meet, and the GDPR and the Data Act shape the contract. For sensitive workloads, buyers tend to shortlist providers that state a national qualification, such as OVHcloud for SecNumCloud in France or STACKIT for C5 in Germany, or an app platform like Scalingo that offers a region on SecNumCloud-qualified infrastructure. For small, non-sensitive projects below the thresholds, a lighter app platform such as Eurobase or Clever Cloud can be enough.

This guide isn't legal advice. Your procurement office and data protection officer have the final word.

The decision at a glance

Step	What decides it	Where the rule comes from
Procedure	Estimated contract value against EU thresholds	Directive 2014/24/EU and national law below the thresholds
Security level	How sensitive the data is	National schemes: SecNumCloud in France, C5 in Germany, ENS in Spain
Data protection	Personal data, processors, transfers outside the EEA	GDPR
Cyber duties	Whether the body is an entity under NIS2	Directive (EU) 2022/2555 and national transposition
Exit	Notice, transition time, export format, switching charges	Data Act, Regulation (EU) 2023/2854

What to check before you shortlist

The contract value over its full term. That figure, not the monthly price, decides whether an EU-wide tender is needed.
The data classification. A public website and a case-management system with health data don't need the same provider.
The scope of each certificate. A qualification covers named services, not the whole company. Ask which product your tender would buy, and confirm it with the body that issued the certificate.
The company and its suppliers. Read the terms for the legal entity and the subprocessor list for anyone outside the EU.
The way out. Check how data is exported and what the provider may charge when you leave.

Step 1: the procurement route

The EU directives on public procurement cover tenders above set values that are presumed to interest bidders across borders, according to the European Commission. Below those values national rules apply, though they must still respect general principles of EU law.

For 2026 and 2027, the thresholds page lists these values for supply and most service contracts:

Buyer	Threshold for services and supplies
Central government authorities	€140,000
Sub-central contracting authorities	€216,000
Utilities under Directive 2014/25/EU	€432,000

A cloud contract above the threshold goes through an EU-wide procedure. Many bodies buy through a framework agreement that someone else has already tendered, so check whether your country or region has one for cloud before you start your own.

Step 2: the national security scheme

Each country sets its own bar, and it can rule providers in or out before price matters. Italy has its own scheme too, covered in ACN cloud qualification.

France: SecNumCloud

France's "cloud au centre" doctrine, published by DINUM, makes cloud the default for new digital projects of state administrations. For data whose breach could harm public order, public safety, health or life, or intellectual property, the commercial cloud chosen must hold the SecNumCloud qualification from ANSSI and be protected against access by public authorities of non-EU states. A European qualification of at least an equivalent level is accepted. A team that wants to depart from the cloud-first rule on a project costing €1 million or more has to justify it to DINUM with a comparative study. More in SecNumCloud explained.

Germany: C5

The BSI, Germany's federal cybersecurity office, publishes C5, a catalogue of minimum requirements for secure cloud computing aimed at providers, their auditors and their customers. First published in 2016, it was completely revised in 2025 and 2026. The BSI calls it a baseline and leaves the customer to judge whether that level is enough for its own use. See BSI C5 for cloud in Germany.

Spain: ENS

The Esquema Nacional de Seguridad, governed by Royal Decree 311/2022, sets security principles and measures for information handled by public bodies. Its official site says it applies to the whole public sector and reaches the suppliers that work with it. See ENS in Spain.

Step 3: data protection, NIS2 and the exit

Under the GDPR, the public body is usually the controller and the cloud provider its processor, so you need a processor contract and a list of subprocessors. Support staff reaching the data from outside the EEA may be a transfer too. The GDPR hosting checklist and data residency vs data sovereignty cover both in detail.

NIS2 lists public administration among its sectors of high criticality. Ask your national authority whether your body is in scope, because an entity in scope carries its own cyber risk and supply chain duties. See NIS2 and DORA for hosting.

For the exit, the Data Act has applied since 12 September 2025. A provider can ask for two months' notice at most, has to finish the switch within a 30-day transition period, and may not charge for switching from 12 January 2027. The details are in the Data Act and cloud switching.

Providers that public buyers shortlist

These five state European operation on their own sites. Facts are from each provider's page, checked on 10 November 2026.

Provider	Company	Certifications stated	Fits
OVHcloud	France	SecNumCloud on four named services	Infrastructure for sensitive French workloads
STACKIT	Schwarz Group, Germany	C5, ISO 27001	Infrastructure for German buyers
Scalingo	Strasbourg, France	ISO 27001, HDS option, SecNumCloud region on Outscale	Managed app platform for regulated apps
Clever Cloud	France	ISO/IEC 27001:2022, HDS, SecNumCloud zone on request	Managed app platform with databases
Eurobase	Warsaw, Poland	None held, ISO 27001 and SOC 2 in progress	Small, non-sensitive web apps and sites

1. OVHcloud

A French cloud group. Four of its offerings carry the qualification, according to its SecNumCloud page: the SNC Cloud Platform, plus qualified versions of Managed VMware vSphere, SAP HANA on Private Cloud and the Bare Metal Pod. It says these are operated, maintained and monitored only by staff based in Europe.

Best for: French state bodies whose data falls under the sensitive-data rule of the doctrine.
What it lacks: the qualification doesn't cover its whole catalogue, so check that the service you need is one of the four.

2. STACKIT

STACKIT belongs to the Schwarz Group, and its legal entity is Schwarz Digits Cloud GmbH & Co. KG. Its site states seven data centres in Europe, displays C5 and ISO 27001 badges, offers a public sector solution and calls itself the first certified partner of the openDesk programme.

Best for: German administrations that ask for C5.

3. Scalingo

A platform from Strasbourg that builds and runs apps from Git. Scalingo states ISO 27001, an HDS option for health data and a SecNumCloud IaaS region on Outscale, and names the French Ministry of the Interior as a customer.

Best for: teams in public bodies that want a managed platform instead of running servers.
Price: a 256 MB container costs €7.20 a month excl. VAT, or €8.64 in its SecNumCloud region.

4. Clever Cloud

Clever Cloud runs managed apps and databases from data centres it operates, with five availability zones around Paris. Its site lists ISO/IEC 27001:2022 and HDS certification. For SecNumCloud, it sells a zone hosted by its partner Cloud Temple, available on request.

Best for: public sector apps that keep their data in a managed database.

5. Eurobase

Eurobase deploys web apps, functions and containers from GitHub, GitLab, Codeberg, Forgejo or Gitea. The business is registered in Warsaw, Poland, and your apps are hosted on European infrastructure run by Scaleway, a French provider. For public sector work it's only a partial fit: there's no national qualification, and ISO 27001 and SOC 2 are still in progress.

Best for: a municipal site, a campaign page or a prototype with no sensitive data, bought below the thresholds.
Price: a Free plan, then €10 or €20 a month + VAT per workspace. There are no usage charges today. Work over a limit is refused, apps on V8 isolates and Functions stop until the monthly reset, and containers and static sites keep serving.
What it lacks: SecNumCloud, C5 or ENS, managed Postgres, MySQL or Redis, Dockerfile builds and preview deployments. Connecting GitHub or GitLab adds GitHub and GitLab Inc. as US subprocessors, while deploying from Codeberg keeps the source code in Europe.

Frequently asked questions

Do public bodies have to use a European cloud provider?

EU procurement law doesn't require a European provider for every contract. National rules can: in France, sensitive data in state administrations must go to a SecNumCloud-qualified offer protected against non-EU authorities.

Can a public body use AWS, Azure or Google Cloud?

The EU procurement directives don't rule them out. The procedure, the GDPR contract and any national security rule still have to be met. Where a scheme demands protection from non-EU public authorities, as France's does for sensitive data, a US-owned provider has to show how its offer meets that rule.

What is the EU threshold for a cloud services tender?

For 2026 and 2027 it's €140,000 for central government authorities and €216,000 for sub-central ones, for service contracts. Below that, national rules apply.

Is there an EU-wide cloud certification?

Not yet. ENISA's EUCS scheme is still a draft, so buyers rely on national schemes such as SecNumCloud, C5 and ENS. See data residency vs data sovereignty.

Does a small municipality need SecNumCloud for its website?

The French doctrine ties SecNumCloud to sensitive data in state administrations. A public website with no personal or sensitive data usually sits outside that rule, but check your own national and local guidance.